6.8
CVSSv2

CVE-2009-5029

Published: 02/05/2013 Updated: 13/02/2023
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 685
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

Integer overflow in the __tzfile_read function in glibc prior to 2.15 allows context-dependent malicious users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu glibc 2.1.2

gnu glibc 2.0.5

gnu glibc 2.0.6

gnu glibc 2.1.1

gnu glibc 2.0.3

gnu glibc 2.0

gnu glibc 2.13

gnu glibc 2.1.1.6

gnu glibc 2.1

gnu glibc 2.1.9

gnu glibc 2.0.1

gnu glibc 2.0.4

gnu glibc 2.0.2

gnu glibc 2.1.3

gnu glibc

Vendor Advisories

Debian Bug report logs - #656108 CVE-2009-5029: Integer overflow in tzfile processing Package: eglibc; Maintainer for eglibc is (unknown); Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Mon, 16 Jan 2012 16:04:37 UTC Severity: normal Tags: security Merged with 650790 Fixed in version eglibc/2113-3 Don ...
Multiple vulnerabilities were discovered and fixed in the GNU C Library ...
Synopsis Moderate: glibc security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated glibc packages that fix multiple security issues and one bug arenow available for Red Hat Enterprise Linux 4The Red Hat Security Response Team has rated this update as having moderatesecurity impact ...
Synopsis Moderate: glibc security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated glibc packages that fix two security issues and three bugs are nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact ...
Synopsis Moderate: glibc security update Type/Severity Security Advisory: Moderate Topic Updated glibc packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability S ...
An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application ...

Exploits

source: wwwsecurityfocuscom/bid/50898/info GNU glibc is prone to an remote integer-overflow vulnerability An attacker can exploit this issue to execute arbitrary code with the privileges of the user running an application that uses the affected library #include <stdioh> #include <stdinth> #include <timeh> #includ ...